I have a
Workflow actions configuration like this:
Apply only to the following fields: "Work Order ID", Work_Order_ID Apply only to the following event types: WIN_ET* Show action in: Both Action type: link URI: http://wo?$Work Order ID$ Open link in: New window Link method: get
After a restart, I expected that I would have a new workflow on the
Statistics tab when I click on any
Work Order ID field, but NO!
index=* eventtype=WIN_ET* | eval Work_Order_ID="W123456789" | eval "Work Order ID" = Work_Order_ID | table W*O
Instead, I have to click on the
Events tab, then click the
> button under
i (turning it into
v) and then scroll down to the fields area of an event, click on the
v control. Here is the ONLY place the
Lookup Work Order W123456789 workflow menu item appears. It does not even appear under the workflows accessed by clicking on the
Event Actions v button.
What's up with that? I absolutely must have a Work Order URL lookup available on the
Statistics tab. How can I do this? Do I need to configure a
drilldown action? I am trying to avoid using a form/dashboard; I need something that works directly from the
I was under same impression as Martin. I haven't seen workflows on stats tab. Would be cool if it was there. I think you are going to need to go form/drilldown route.
As others have mentioned, the Event/Field workflows are not available in the statistics tab/table view. The data/rows shown here are not directly linked to Events in this view, i.e. you are seeing data from events but the information about the data to the event is not present there. Think of this like looking at store bought food presented on a snack tray, but then you can't check the nutrition facts looking at the food because the food is without the packaging.
I could see how being able to have workflows on fields in Statistics (if possible) would be useful. If this is a feature you'd like to request, note that we have an internal Enhancement Request: SPL-119276 .
To request this feature (and show support for it), please create a Support ticket with Splunk mentioning this Splunk Answer page and ask to be added to ER SPL-119276. Support will link your request to this ER and close the support case (which basically functions like an upvote for the ER).